txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the
superblock info, drops TXN_LOCK and then takes log->gclock, while
lmLogClose() can free that log during umount.
No fix has been merged. The 2023 proposal was withdrawn by its author
("I think my fix method is not a good solution"), and proposals in 2026
for similar jfs slab use-after-free races are unreviewed:
https://lore.kernel.org/all/[email protected]/
https://lore.kernel.org/all/[email protected]/
https://lore.kernel.org/all/[email protected]/
A similar use-after-free was reported against 7.0-rc1 in June 2026,
with the free stack in lmLogClose() via jfs_umount(), and syzbot has
an open slab use-after-free write in lmLogSync(); the txEnd() sequence
is unchanged in linux-next 20260727:
https://lore.kernel.org/all/[email protected]/
https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
CC: Paul Barker <[email protected]>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <[email protected]>
---
v4:
- describe the 2026 proposals and reports as similar races rather than
the same one; drop the kernel-cache configuration paragraph; use the
review's comment and status wording
- name the open syzbot bug as the lmLogSync write rather than the
txEnd write
v3:
https://lore.kernel.org/openembedded-core/[email protected]/
meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc
b/meta/recipes-kernel/linux/cve-exclusion.inc
index 4318fc79..a133bf08 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -231,3 +231,12 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from
version 6.17"
# https://security-tracker.debian.org/tracker/CVE-2022-4543
# https://ubuntu.com/security/CVE-2022-4543
CVE_STATUS[CVE-2022-4543] = "unpatched: No fix has been proposed"
+
+# Triaged August 2026 - Originally proposed fix was withdrawn, similar
+# slab-use-after-free appears to have been re-found by syzkaller in 2026.
+# Unfixed in Debian, "needs evaluation" in Ubuntu.
+#
https://lore.kernel.org/lkml/cajedcczmx02bfa22qeze8mu-idssdsy_oapt2ozcwo8o-8m...@mail.gmail.com/
+# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb
+# https://security-tracker.debian.org/tracker/CVE-2023-3397
+# https://ubuntu.com/security/CVE-2023-3397
+CVE_STATUS[CVE-2023-3397] = "unpatched: Proposed fix was withdrawn"
--
2.43.0
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#244052):
https://lists.openembedded.org/g/openembedded-core/message/244052
Mute This Topic: https://lists.openembedded.org/mt/120897565/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
